DP-900 Practice Question: Identify considerations for relational data on Azure
A company uses Azure SQL Database and needs to implement data masking for sensitive columns like email addresses and credit card numbers, so that only authorized users can see the actual data. Which feature should they configure?
⚠ Common exam trap
Candidates often confuse Dynamic Data Masking (which hides data in query results) with Transparent Data Encryption (which protects data at rest), leading them to select TDE when the requirement is about controlling visibility to specific users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic Data Masking
Dynamic Data Masking (DDM) is the correct feature because it limits exposure of sensitive data by obfuscating columns (e.g., email addresses, credit card numbers) in query results to non-privileged users, while authorized users (with EXEMPT or UNMASK permission) see the actual data. This directly meets the requirement of masking sensitive columns without altering the underlying stored data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Row-Level Security
Why it's wrong here
Row-Level Security (RLS) restricts the rows a query returns based on a user-defined predicate and the current principal, effectively filtering the result set before it is delivered. This means RLS can hide entire records, but it cannot modify or obfuscate individual column values within a returned row, such as a credit card number or email address. Because the requirement is specifically to mask certain data values in query results, RLS is the wrong mechanism; Dynamic Data Masking is designed for that column-level obfuscation.
- ✓
Dynamic Data Masking
Why this is correct
Dynamic Data Masking (DDM) in Azure SQL Database is the correct choice because it applies masking functions to designated sensitive columns at query time, so unauthorized users see obfuscated values (for example, xxxx-xxxx-xxxx-1234) while the underlying stored data remains unchanged. DDM does not alter the database physically; instead, it transforms the result set in place, and users with the ALTER ANY MASK permission can still query the unmasked values. This precisely matches the requirement to hide sensitive data from query results while leaving the data intact.
- ✗
Auditing
Why it's wrong here
Auditing is a diagnostic and compliance feature that records database events, actions, and data access attempts to an audit log, enabling you to review activity after the fact for security and regulatory purposes. It does not modify query output, nor does it prevent a user from seeing sensitive data when the query runs; it only logs that the access occurred. Therefore, auditing cannot fulfill a requirement to hide sensitive column values in query results—it is meant for monitoring, not masking.
- ✗
Transparent Data Encryption (TDE)
Why it's wrong here
Transparent Data Encryption (TDE) performs real-time encryption and decryption of the database files, backups, and transaction logs at the storage layer, protecting data at rest from theft of physical media. When an authorized query runs, the SQL engine transparently decrypts the data and returns complete plaintext values to the client; TDE has no effect on the shape or visibility of query results. Hence, while TDE is an important security control, it does not mask data in result sets and is the wrong answer for a data-masking requirement.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.